libextractor

fuzz_plugin.c (16366B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file fuzz/fuzz_plugin.c
  * @brief generic in-process fuzzer for a single libextractor plugin
  * @author Christian Grothoff
  *
  * This one source is compiled once per plugin.  `-DLE_FUZZ_PLUGIN=gif`
  * produces the `fuzz_gif` target, which calls
  * `EXTRACTOR_gif_extract_method()` directly -- the plugin's own object
  * files are linked in, so every line of the parser is instrumented, and
  * no `dlopen()`, no `fork()` and no IPC is involved.
  *
  * The extraction context is the contract-exact model in fuzz_ec.h; read
  * its header comment first, it is where the interesting properties are.
  *
  * Input format:
  *
  *   byte 0    read window size selector (0 = the production 16 KiB)
  *   byte 1    fault-injection bitmask, see LE_FUZZ_FAULT_* in fuzz_ec.h
  *   byte 2    call index at which the injected fault fires
  *   byte 3    reserved, must be present
  *   byte 4..  the file image handed to the plugin
  *
  * An all-zero prefix is exactly what production does, so a corpus entry
  * is just four zero bytes followed by a real file of the format; that is
  * what contrib/oss-fuzz/make_seed_corpus.sh generates from
  * src/plugins/testdata/.
  */
 
 #include "fuzz_plugin_name.h"
 
 #define FUZZ_HARNESS_NAME "fuzz_" LE_FUZZ_PLUGIN_STR
 
 #include "fuzz_common.h"
 #include "fuzz_ec.h"
 
 /**
  * The plugin's extract method, resolved at link time rather than through
  * `lt_dlsym()`.
  */
 extern void
 LE_FUZZ_EXTRACT_METHOD (struct EXTRACTOR_ExtractContext *ec);
 
 /**
  * The plugin's optional configuration hook.  Declared weak: most plugins
  * do not have one.
  */
 extern const char *
 LE_FUZZ_OPTIONS_METHOD (void) __attribute__ ((weak));
 
 #ifdef LE_FUZZ_LSAN_SUPPRESSIONS
 /**
  * Leak suppressions for plugins whose library keeps global state that
  * is never released (see fuzz_plugin_name.h).
  *
  * @return suppression list in LSan syntax
  */
 const char *
 __lsan_default_suppressions (void);
 
 const char *
 __lsan_default_suppressions (void)
 {
   return LE_FUZZ_LSAN_SUPPRESSIONS;
 }
 
 
 /**
  * The suppressions match on library frames; the default frame-pointer
  * unwinder loses those in libraries built without frame pointers, so
  * use the slow unwinder for allocations.
  *
  * @return default options for LeakSanitizer
  */
 const char *
 __lsan_default_options (void);
 
 const char *
 __lsan_default_options (void)
 {
   return "fast_unwind_on_malloc=0";
 }
 
 
 #endif
 
 #ifndef LE_FUZZ_CONFIGS
 /**
  * Plugin configurations to fuzz.  fuzz_plugin_name.h may define
  * LE_FUZZ_CONFIGS as a comma-separated list of configuration strings
  * for plugins that have options; entry 0 is always NULL, i.e. the
  * configuration used when the user gives no options.
  */
 #define LE_FUZZ_CONFIGS NULL
 #endif
 
 /**
  * Configurations selected by the fourth prefix byte.
  */
 static const char *const le_fuzz_configs[] = { LE_FUZZ_CONFIGS };
 
 /**
  * Number of entries in #le_fuzz_configs.
  */
 #define LE_FUZZ_NUM_CONFIGS (sizeof (le_fuzz_configs) \
                              / sizeof (le_fuzz_configs[0]))
 
 
 /* ------------------------------------------------------------------ */
 /* The fuzz target                                                     */
 /* ------------------------------------------------------------------ */
 
 int
 LLVMFuzzerTestOneInput (const uint8_t *data,
                         size_t size)
 {
   struct EXTRACTOR_ExtractContext ec;
   struct fuzz_ec_state st;
 
   fuzz_ignore_sigpipe ();
   if (! le_fuzz_ec_setup (&ec, &st, data, size))
     return 0;
   ec.config = le_fuzz_configs[data[3] % LE_FUZZ_NUM_CONFIGS];
   LE_FUZZ_EXTRACT_METHOD (&ec);
   if (0 != (st.faults & LE_FUZZ_RUN_TWICE))
   {
     /* A plugin must not carry state from one file to the next: the same
        process is reused for every file in a directory walk. */
     le_fuzz_ec_rewind (&st);
     LE_FUZZ_EXTRACT_METHOD (&ec);
   }
   le_fuzz_ec_cleanup (&st);
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Structure-aware generator                                           */
 /* ------------------------------------------------------------------ */
 
 /* The body shapes -- LE_SHAPE_RAW (magic plus random bytes),
    LE_SHAPE_CHUNK_BE (tag + big-endian length + payload, as in PNG and
    QuickTime), LE_SHAPE_CHUNK_LE (RIFF/WAV/AVI), LE_SHAPE_TEXT
    (line-oriented) and LE_SHAPE_ZIP -- are #defined in
    fuzz_plugin_name.h, because that header has to select one before this
    translation unit could declare an enum. */
 
 /**
  * Magic bytes and body shape of the format this target parses.  Chosen
  * per plugin at compile time by fuzz_plugin_name.h.
  */
 static const char le_fuzz_magic[] = LE_FUZZ_MAGIC;
 
 /**
  * Number of bytes in #le_fuzz_magic (the trailing NUL is not part of it
  * unless the format really has one).
  */
 #define LE_FUZZ_MAGIC_LEN (sizeof (le_fuzz_magic) - 1)
 
 /**
  * Four-character tags that appear in the chunked formats.
  */
 static const char *const le_fuzz_tags[] = {
   "IHDR", "tEXt", "zTXt", "iTXt", "pHYs", "tIME", "IEND", "PLTE",
   "LIST", "INFO", "fmt ", "data", "INAM", "IART", "ICMT", "ICRD",
   "moov", "mvhd", "trak", "udta", "meta", "ilst", "\xa9nam", "cmov",
   "avih", "strh", "strf", "movi", "JUNK", "AAAA", "\x00\x00\x00\x00"
 };
 
 /**
  * Text fragments that appear in the line-oriented formats.
  */
 static const char *const le_fuzz_lines[] = {
   "%%Title: fuzz\n", "%%Creator: fuzz\n", "%%Pages: 1\n",
   "%%BoundingBox: 0 0 1 1\n", "%%EOF\n", "%!PS-Adobe-3.0\n",
   ".TH FUZZ 1 \"2026\" \"le\" \"fuzz\"\n", ".SH NAME\n", ".SH SYNOPSIS\n",
   "{\\rtf1\\ansi\\deff0", "{\\info{\\title fuzz}}", "{\\*\\generator x}",
   "\\u1234?", "\\'ff", "\\par ", "}", "{", "\\\\",
   "<html><head><title>fuzz</title>", "<meta name=\"author\" content=\"x\">",
   "\n", "\r\n", "\t", "                              "
 };
 
 
 /**
  * Append a chunk-structured body to @a buf.
  *
  * @param rng PRNG state
  * @param buf output buffer
  * @param[in,out] len current length
  * @param cap capacity
  * @param big non-zero for big-endian lengths
  */
 static void
 le_fuzz_gen_chunks (struct fuzz_rng *rng,
                     uint8_t *buf,
                     size_t *len,
                     size_t cap,
                     int big)
 {
   unsigned int n = 1 + fuzz_below (rng, 12);
   unsigned int i;
 
   for (i = 0; i < n; i++)
   {
     const char *tag =
       le_fuzz_tags[fuzz_below (rng,
                                (uint32_t) (sizeof (le_fuzz_tags)
                                            / sizeof (le_fuzz_tags[0])))];
     uint32_t plen = fuzz_below (rng, 96);
     uint32_t decl;
     unsigned int k;
 
     /* Every so often declare a length that has nothing to do with the
        number of bytes actually present.  This is the single most
        productive mutation for these parsers. */
     if (fuzz_chance (rng, 3))
     {
       static const uint32_t bogus[] = {
         0, 1, 0x7FFFFFFF, 0x80000000, 0xFFFFFFFF, 0xFFFF, 0x10000
       };
 
       decl = bogus[fuzz_below (rng,
                                (uint32_t) (sizeof (bogus)
                                            / sizeof (bogus[0])))];
     }
     else
     {
       decl = plen;
     }
     if (big)
     {
       fuzz_put_mem (buf, len, cap, tag, 4);
       fuzz_put_be (buf, len, cap, decl, 4);
     }
     else
     {
       fuzz_put_be (buf, len, cap, decl, 4);
       fuzz_put_mem (buf, len, cap, tag, 4);
     }
     if (*len + plen > cap)
       return;
     for (k = 0; k < plen; k++)
       buf[(*len)++] = fuzz_byte (rng);
   }
 }
 
 
 /**
  * Append a ZIP skeleton to @a buf: one local file header, one central
  * directory entry and an end-of-central-directory record, with
  * fuzzer-chosen (often inconsistent) offsets and sizes.
  */
 static void
 le_fuzz_gen_zip (struct fuzz_rng *rng,
                  uint8_t *buf,
                  size_t *len,
                  size_t cap)
 {
   static const char *const names[] = {
     "mimetype", "meta.xml", "content.xml", "docProps/core.xml",
     "word/document.xml", "xl/workbook.xml", "ppt/presentation.xml",
     "META-INF/manifest.xml", "a", ""
   };
   const char *name =
     names[fuzz_below (rng, (uint32_t) (sizeof (names) / sizeof (names[0])))];
   size_t nlen = strlen (name);
   size_t lfh_off = *len;
   uint32_t payload = fuzz_below (rng, 64);
   unsigned int k;
 
   fuzz_put_mem (buf, len, cap, "PK\x03\x04", 4);
   fuzz_put_le (buf, len, cap, 20, 2);                   /* version */
   fuzz_put_le (buf, len, cap, fuzz_byte (rng), 2);      /* flags */
   fuzz_put_le (buf, len, cap, fuzz_chance (rng, 2) ? 0 : 8, 2); /* method */
   fuzz_put_le (buf, len, cap, 0, 4);                    /* time/date */
   fuzz_put_le (buf, len, cap, fuzz_next (rng), 4);      /* crc */
   fuzz_put_le (buf, len, cap,
                fuzz_chance (rng, 3) ? fuzz_next (rng) : payload, 4);
   fuzz_put_le (buf, len, cap,
                fuzz_chance (rng, 3) ? fuzz_next (rng) : payload, 4);
   fuzz_put_le (buf, len, cap, nlen, 2);
   fuzz_put_le (buf, len, cap, fuzz_chance (rng, 4) ? fuzz_below (rng, 64) : 0,
                2);
   fuzz_put_mem (buf, len, cap, name, nlen);
   if (*len + payload > cap)
     return;
   for (k = 0; k < payload; k++)
     buf[(*len)++] = fuzz_byte (rng);
 
   {
     size_t cd_off = *len;
 
     fuzz_put_mem (buf, len, cap, "PK\x01\x02", 4);
     fuzz_put_le (buf, len, cap, 20, 2);
     fuzz_put_le (buf, len, cap, 20, 2);
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap, 0, 4);
     fuzz_put_le (buf, len, cap, 0, 4);
     fuzz_put_le (buf, len, cap, payload, 4);
     fuzz_put_le (buf, len, cap, payload, 4);
     fuzz_put_le (buf, len, cap, nlen, 2);
     fuzz_put_le (buf, len, cap, 0, 2);                  /* extra */
     fuzz_put_le (buf, len, cap,
                  fuzz_chance (rng, 4) ? fuzz_next (rng) : 0, 2); /* comment */
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap, 0, 4);
     fuzz_put_le (buf, len, cap,
                  fuzz_chance (rng, 4) ? fuzz_next (rng) : lfh_off, 4);
     fuzz_put_mem (buf, len, cap, name, nlen);
 
     fuzz_put_mem (buf, len, cap, "PK\x05\x06", 4);
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap, 0, 2);
     fuzz_put_le (buf, len, cap,
                  fuzz_chance (rng, 4) ? fuzz_next (rng) : 1, 2);
     fuzz_put_le (buf, len, cap,
                  fuzz_chance (rng, 4) ? fuzz_next (rng) : 1, 2);
     fuzz_put_le (buf, len, cap, *len - cd_off, 4);
     fuzz_put_le (buf, len, cap,
                  fuzz_chance (rng, 4) ? fuzz_next (rng) : cd_off, 4);
     fuzz_put_le (buf, len, cap, 0, 2);
   }
 }
 
 
 static size_t
 fuzz_generate (struct fuzz_rng *rng,
                uint8_t *buf,
                size_t cap)
 {
   size_t len = 0;
   unsigned int shape = LE_FUZZ_SHAPE;
 
   if (cap < 64)
     return 0;
   /* configuration prefix */
   buf[len++] = fuzz_chance (rng, 2) ? 0 : fuzz_byte (rng);
   buf[len++] = fuzz_chance (rng, 3) ? 0 : (uint8_t) fuzz_below (rng, 0x40);
   buf[len++] = fuzz_byte (rng);
   buf[len++] = fuzz_byte (rng);
 
   /* magic; occasionally corrupted so that the reject path is covered
      too, but usually intact so that the parser is actually entered */
   fuzz_put_mem (buf, &len, cap, le_fuzz_magic, LE_FUZZ_MAGIC_LEN);
   if ( (LE_FUZZ_MAGIC_LEN > 0) &&
        fuzz_chance (rng, 12) )
     buf[LE_FUZZ_EC_PREFIX + fuzz_below (rng, (uint32_t) LE_FUZZ_MAGIC_LEN)] =
       fuzz_byte (rng);
 
   switch (shape)
   {
   case LE_SHAPE_CHUNK_BE:
     le_fuzz_gen_chunks (rng, buf, &len, cap, 1);
     break;
   case LE_SHAPE_CHUNK_LE:
     /* RIFF: overall size field, form type, then LE chunks */
     fuzz_put_le (buf, &len, cap,
                  fuzz_chance (rng, 3) ? fuzz_next (rng) : cap, 4);
     fuzz_put_mem (buf, &len, cap,
                   fuzz_chance (rng, 2) ? "WAVE" : "AVI ", 4);
     le_fuzz_gen_chunks (rng, buf, &len, cap, 0);
     break;
   case LE_SHAPE_TEXT:
     {
       unsigned int n = 1 + fuzz_below (rng, 40);
       unsigned int i;
 
       for (i = 0; i < n; i++)
       {
         if (fuzz_chance (rng, 6))
         {
           unsigned int k;
           unsigned int r = 1 + fuzz_below (rng, 200);
 
           for (k = 0; (k < r) && (len < cap); k++)
             buf[len++] = fuzz_byte (rng);
         }
         else
         {
           fuzz_put_str (buf, &len, cap,
                         le_fuzz_lines[fuzz_below (rng,
                                                   (uint32_t)
                                                   (sizeof (le_fuzz_lines)
                                                    / sizeof (char *)))]);
         }
       }
       break;
     }
   case LE_SHAPE_ZIP:
     le_fuzz_gen_zip (rng, buf, &len, cap);
     break;
   case LE_SHAPE_RAW:
   default:
     {
       unsigned int n = fuzz_below (rng, 1024);
       unsigned int i;
 
       for (i = 0; (i < n) && (len < cap); i++)
       {
         if (fuzz_chance (rng, 16))
         {
           /* a run of one value: length fields and counters love these */
           unsigned int k;
           unsigned int r = 1 + fuzz_below (rng, 64);
           uint8_t v = fuzz_chance (rng, 2) ? 0xFF : fuzz_byte (rng);
 
           for (k = 0; (k < r) && (len < cap); k++)
             buf[len++] = v;
         }
         else
         {
           buf[len++] = fuzz_byte (rng);
         }
       }
       break;
     }
   }
   return len;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Built-in seed corpus                                                */
 /* ------------------------------------------------------------------ */
 
 /**
  * The built-in seeds are deliberately minimal: the interesting seeds are
  * the real files under src/plugins/testdata/, which
  * contrib/oss-fuzz/make_seed_corpus.sh turns into corpus entries.  These
  * exist so that a bare `make -C src/fuzz check` still starts from
  * something that gets past the magic-number test.
  */
 #define LE_FUZZ_NSEEDS 6
 
 static uint8_t le_fuzz_seed_buf[LE_FUZZ_NSEEDS][512];
 static size_t le_fuzz_seed_len[LE_FUZZ_NSEEDS];
 static int le_fuzz_seeds_ready;
 
 
 static void
 le_fuzz_build_seeds (void)
 {
   struct fuzz_rng rng;
   unsigned int i;
 
   if (le_fuzz_seeds_ready)
     return;
   le_fuzz_seeds_ready = 1;
   for (i = 0; i < LE_FUZZ_NSEEDS; i++)
   {
     /* Seed 0 is the bare magic with the production configuration; the
        others vary the window size, which is what most reliably changes
        which code path a parser takes. */
     size_t len = 0;
     uint8_t *b = le_fuzz_seed_buf[i];
 
     fuzz_rng_seed (&rng, 0x5EED0000u + i);
     if (0 == i)
     {
       /* the bare magic under the production configuration */
       len = LE_FUZZ_EC_PREFIX;
       memset (b, 0, len);
       fuzz_put_mem (b, &len, sizeof (le_fuzz_seed_buf[i]),
                     le_fuzz_magic, LE_FUZZ_MAGIC_LEN);
     }
     else
     {
       len = fuzz_generate (&rng, b, sizeof (le_fuzz_seed_buf[i]));
       if (len < LE_FUZZ_EC_PREFIX)
         len = LE_FUZZ_EC_PREFIX;
       /* pin the configuration so that the seeds cover the knobs that
          matter rather than whatever the PRNG happened to pick */
       b[0] = (uint8_t) (i + 1);                              /* window */
       b[1] = (uint8_t) ((4 == i) ? LE_FUZZ_RUN_TWICE : 0);   /* faults */
       b[2] = (uint8_t) ((5 == i) ? 1 : 0);
       /* cycle through the plugin configurations */
       b[3] = (uint8_t) (i % LE_FUZZ_NUM_CONFIGS);
     }
     le_fuzz_seed_len[i] = len;
   }
 }
 
 
 static size_t
 fuzz_seed_count (void)
 {
   le_fuzz_build_seeds ();
   return LE_FUZZ_NSEEDS;
 }
 
 
 static const uint8_t *
 fuzz_seed_get (size_t idx,
                size_t *len)
 {
   le_fuzz_build_seeds ();
   *len = le_fuzz_seed_len[idx];
   return le_fuzz_seed_buf[idx];
 }